A governance guidance standard for the use of Artificial Intelligence (AI) based on ISO/IEC 38507:2022 (Information technology — Governance of IT — Governance implications of the use of artificial intelligence by organizations).

Aligned to the ISO/IEC 38500 “Governance of IT” principles, ISO/IEC 38507:2022 is written for governing bodies (boards, trustees, and equivalent) and executive leaders to help them evaluate, direct, and monitor AI use so it remains effective, efficient, and acceptable within the organization. It focuses on governance accountability and decision rights—not technical model design—so AI adoption is treated as a strategic, risk-managed business capability.

The standard provides practical governance guidance across the AI lifecycle and the organizational conditions that shape AI outcomes. It addresses key governance considerations such as:

• Board-level accountability and oversight for AI outcomes (including escalation pathways and decision authority)
• Governing AI-enabled decision-making (human oversight, contestability, and transparency expectations)
• Governing data use for AI (data quality, provenance, permitted use, and protection of sensitive information)
• Culture and values (ensuring AI use aligns with organizational values and stakeholder expectations)
• Compliance obligations (legal, regulatory, and contractual considerations relevant to AI use)
• Risk management and assurance (identifying AI-specific risks such as bias, misuse, drift, and third-party dependency, and ensuring monitoring and review)

If your organization is already using AI (including automation and decision support) or is considering adoption, Cyber Security Centre’s ISO/IEC 38507:2022 overview can help you translate the standard into board-ready governance artefacts—such as AI policy positions, decision and accountability models, risk registers, and evidence-based oversight routines—appropriate to your operating environment and risk appetite.

• Inspires trust – provides customers, regulators, and stakeholders with greater confidence that AI is governed responsibly and transparently.
• Improves decision quality – strengthens executive and board oversight of AI-enabled decisions, reducing unmanaged automation risk.
• Protects your brand reputation – reduces the likelihood and impact of harmful AI outcomes (e.g., biased decisions, inappropriate use, or poorly governed deployments).
• Supports compliance – helps structure governance to meet evolving legal, regulatory, and contractual expectations for AI use.
• Enables safe innovation – provides a clear governance foundation so teams can adopt AI faster while maintaining accountability, control, and assurance.

ISO/IEC 38507:2022 is particularly valuable because it focuses on governing-body accountability for AI use and clarifies what “good governance” looks like when decisions, processes, and services become partially automated. Directors, executives, risk owners, legal/compliance leaders, and technology teams can reduce organisational risk by defining decision rights, required levels of human oversight, and governance expectations for AI suppliers and internal teams—supporting more consistent, defensible AI adoption across the organisation.

As a cyber security research organization, Cyber Security Centre provides evidence-based insight across a broad range of cyber and technology risk topics, including AI governance and assurance. Our professional staff hold postgraduate qualifications (Master’s & PhD) research, enabling us to deliver informed, practical guidance grounded in current research and industry practice